NoSQL injection: operators and query-shape control

Mechanism

NoSQL injection can alter query syntax or inject operator objects where an application expects a scalar. The attack model depends on database, driver, serialization, and the application query builder. JSON acceptance alone does not imply operators reach the database. Strict typing and allowlisted query structure prevent many operator injection paths.

Practical method

Identify whether the input is parsed as a string, array, or object. Compare a normal scalar with a harmless structured value and inspect the resulting behavior. Determine which operators are supported only after confirming query-shape influence. Keep authentication bypass, data extraction, and server-side scripting as separate capabilities.

if (typeof body.username !== "string") throw new Error("invalid type");
const query = { username: body.username };
// Never merge an arbitrary client object into the database query.

Interpreting evidence

A type-dependent response can come from validation rather than query execution. Use complementary conditions and known fixture data to show that an injected query operator changes matching behavior.

Pitfalls and limits

MongoDB-specific operators are not portable to other stores. URL-encoded bracket notation depends on parser configuration. A database feature may be disabled or unsupported even when the driver accepts an object.